A missing authorization check in the FileSystem API of Google Chrome represents a CWE-862 flaw. It allows an attacker who has already compromised the renderer process and employed social engineering to persuade a user to visit a maliciously crafted HTML page to access sensitive data. Because the API lacks proper access controls, the attacker can read or write files that the renderer process can reach, leading to disclosure of confidential information. The flaw does not directly grant arbitrary code execution but does enable significant data leakage if the renderer is already subverted.

Affected product: Google Chrome versions prior to 152.0.7977.75. The issue is specific to the FileSystem API implemented within the Chrome renderer component; all installations of Chrome below the specified patch level are potentially vulnerable.

Chromium's internal severity rating is Medium, and no public CVSS score has been published, so the overall technical severity is not formally quantified. The EPSS score is not available and the vulnerability is not in the CISA KEV catalog. Exploitation requires first compromising the renderer process, which can be achieved via a separate vulnerability or social engineering tactics, followed by delivering a malicious HTML payload that utilizes the unprotected FileSystem API. Because the attack chain depends on a prior compromise, the likelihood of widespread exploitation is limited, but within target environments that allow users to run HTML pages, the risk of data exfiltration is still present.